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Abstract. The cryptographic protocol of coin tossing consists of two parties, Alice 
and Bob, that do not trust each other, but want to generate a random bit. If the parties 
use a classical communication channel and have unlimited computational resources, one 
of them can always cheat perfectly. Here we analyze in detail how the performance of a 
quantum coin tossing experiment should be compared to classical protocols, taking into 
account the inevitable experimental imperfections. We then report an all-optical fiber 
experiment in which a single coin is tossed whose randomness is higher than achievable 
by any classical protocol and present some easily realisable cheating strategies by Alice 
and Bob. 
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1. Introduction 

The cryptographic protocol of coin tossing introduced by Blum [1] consists of two 
parties, Alice and Bob, that do not trust each other, but want to generate a 
random bit. If the parties use a classical communication channel and have unlimited 
computational resources, one of them can always cheat perfectly. But what if they 
use a quantum communication channel? Because of its conceptual importance and 
potential applications, quantum coin tossing was already envisaged by Bennett and 
Brassard in their seminal paper on quantum cryptography [2] . Later works showed that 
perfect quantum coin tossing is impossible [U Ej [6], but that imperfect protocols exist 
[3 El El [9l [TOl [11] that perform better than any classical protocol. 

Work on quantum coin tossing distinguishes between "weak coin tossing" and 
"strong coin tossing". In weak coin tossing Alice and Bob have antagonistic goals: 
Alice wants the coin to be heads, say, whereas Bob wants the coin to come out tails. 
Good quantum protocols for weak coin tossing exist, although they seem very difficult 
to implement [11] . In strong coin tossing Alice and Bob both want the coin to be 
perfectly random. Quantum protocols that perform better at strong coin tossing than 
any classical protocol exist P, [10] and come close to the known upper bound (for the 
original unpublished proof of the upperbound, see [6]; published proofs can be found in 

mm)- 

Quantum coin tossing itself is just one example of several interesting tasks that 
two parties which do not trust each other can achieve if they share a quantum 
communication channel, but cannot achieve if they use a classical communication 
channel. Other examples include multiparty coin tossing [12] and weak forms of string 
committment [Til [T5] . The no go theorems mentioned above [ll[5l[6] rule out most other 
applications, except if one adds additional assumptions such as bounding the size of 
quantum memories |16j. 

Recently two works [T71 [18] have experimentally studied optical implementations 
of quantum coin tossing. However the experiment of ref. [17] suffered from important 
photon loss which made it difficult to assess how the experiment worked when tossing 
a single coin. This was circumvented, as in [18], by addressing string flipping, i.e. the 
problem where the parties try to toss a string of coins rather than a single one. These 
works were however carried out without realizing that good classical protocols exist for 
string flipping, see e.g. [I9] for a presentation of such protocols. 

In the present work we go back to the conceptually simpler problem of tossing a 
single coin, and report an experiment in which a single coin is tossed whose randomness 
is higher than achievable by any classical protocol. We begin by discussing in detail 
how the results of such a coin tossing experiment should be compared with classical 
protocols in view of the inevitable imperfections that will occur in any experimental 
realisation. Coin tossing in the presence of noise was already studied in [20], but with 
the emphasiz on applications to string flipping, whereas here we are concerned with 
tossing a single coin. We then present the experimental implementation, which follows 
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closely the earlier work of [TB] , and present some easily realisable cheating strategies by 
Alice and Bob. 

2. Formulation of the problem 

A protocol for coin tossing consists in a series of rounds of (classical or quantum) 
communication at the end of which the parties decide on an outcome. The outcome 
can be either a decision that the coin has the value c = or c = 1, or it can be that 
the protocol aborts, in which case we say that c =_L. Note that because the rounds of 
(quantum or classical) communication are sequential, it is logically possible for Alice to 
choose one output x, and for Bob to chose another output y. For the sake of generality 
it is convenient to take this into account and to denote by 

Pxy = Probability that in an honest execution of the 
protocol Alice outputs x and Bob outputs y, 
where x,y & {0, 1, ±}. 

We will say that a protocol is correct, if, when both parties are honest, at the end 
of the protocol they agree on the outcome, and that the results c = and c = 1 occur 
with equal probability: poo = Pii = (1 ~P±±)/2- This formulation takes into account 
that because of experimental imperfections, the outcome c =_L may occur even when 
both parties are honest. 

The aim of a cheater is to force the outcome of the coin tossing protocol. We denote 

by 

p*y = Probability that a dishonest Alice can force an 

honest Bob to output y 
Pxi, = Probability that a dishonest Bob can force an 
honest Alice to output x 

An alternative notation often used in the litterature is the bias e which is related to our 
notation by 

sa = max{p^y - ^) 

eB = max(p^^ - ^) (1) 

The bound due to Kitaev [6l[T2l[T3] states that either e^i or is greater or equal to l/-\/2. 
The best known protocol for strong coin tossing due to Ambainis has = = 1/4. 
In our experimental implementation, as we will see later, we will be concerned by a 
protocol which in the terminology of [lO] has "po and pi both pure" . For such protocols 
it is proven in [10] that + e| > 1/4. 

In the appendix we prove the following (which generalises a result of [6] when 
P±± = 0): 
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Lemma 1: For any correct classical coin tossing protocol with three outcomes 0, 1, _L we 
have: 

(1 -j9o*)(l <P±± , (2) 
{1-Pu){1-P*q) <p±± ■ (3) 

Note that if = these inequalities imply that either po* = 1 or = 1, and 
that either pu = 1 or = 1) thereby showing that classical coin tossing is impossible. 
When 7^ a cheater can no longer necessarily force the outcome he wants. In the 
supplementary material we show that there exist classical protocols that saturate either 
one of equations ([2]) or ([3]), and that there exist classical protocols that come close to 
saturating both equations ([2]) and ([3]). 

In view of Lemma 1, it is natural to quantify the quality of quantum coin tossing 
experiments by the following merit function: 

^ (1 -p.o)(l -Pu) (1 -Po.) _ , . 

2 2 ^ ' 

which has the following properties: 

(i) Positivity of probabilities implies — 1 < < +1 

(ii) For any classical protocol we have M. <{) 

(iii) An ideal protocol would have M. = 1. 

The interpretation of the merit function is most obvious in the weak coin tossing scheme 
wherein Alice wins if Bob outputs 1 while Bob wins if Alice outputs because then the 
term (1 — — Po*) is the product of how often a dishonest Alice cannot force a 

win times how often a dishonest Bob cannot force a win (and similarly for the term 
(1 — p*o)(l ~ Pi*))- The better the protocol, the larger these terms. 

As illustration let us compute the value of M. for different protocols. The bound due 
to Kitaev states with precision, see [I2], that p*ipi* > 1/2 and p*oPo* > 1/2- Inserting 
this into eq . (jl]) shows that for all quantum protocols, < (1 — 1/v^)^ ~ 0.086. For 
Ambainis's protocol [9] for instance we have M. = = 0.0625. 



3. Experimental Implementation 

3.1. The Protocol 

Our implementation of quantum coin tossing uses the following protocol: 

(i) Alice chooses a G {0, 1} at random. She prepares state ipa, where the two possible 
states are non orthogonal: |(?/'i|^/;o)| = cos 6* > 0. She sends ipa to Bob. 
The states ipQ^i will be taken to be coherent states of light of amplitude a and 
opposite phase: 

|V'o) = |+a) , \iJi) = \-a) (5) 
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which imphes that 

cos^^ = \{^Pl\^Po)\' = \{-a\ + a)\' = e-'"\ (6) 

In the notation of we thus have po = |^o)(^o| and pi = \ipi){ipi\ both pure. 
Also note that po pi prevents from cheating strategies based on entanglement 

(ii) Bob chooses 6 G {0, 1} at random. He tells the value of b to Alice. 

(iii) Alice tells Bob the value of a. 

(iv) Bob carries out a measurement which projects onto tpa or onto the orthogonal 
space. If he finds that the state is not equal to ipa he aborts, and the outcome of 
the protocol is _L. If he finds that the state is equal to tpa then the outcome of the 
protocol is c = a (B b. 

Bob's measurement is carried out as follows: using a local oscillator (LO), he 
displaces the quantum state by +a if a = 1 or by —a if a = 0. If Alice is honest 
this results in the state becoming the vacuum state. To check this Bob then sends 
the resulting state onto a single photon detector. If the detector clicks then Bob 
assumes that Alice was cheating and he aborts: the outcome of the protocol is _L. 
If the detector does not click, then Bob assumes that Alice is honest. (Note that 
Bob's measurement is similar in spirit to the method proposed in [21] for quantum 
state tomography, but Bob's task is simpler since he only needs to detect if Alice 
is cheating, and not carry out the full state tomography). 



3.2. Analysis in the absence of imperfections 

We now study how the merit function Ai depends on the details of the experiment. For 
the sake of comparison we first look at the situation in the absence of imperfections. 
First of all, in this case p±± = 0. 

Second, if Alice is dishonest she will send a fixed state |0) at step 1 and at step 
3 she will choose the value of a which will make her win the protocol, and then she 
will hope that Bob will not abort. The probability that Bob will abort is given by the 
overlap of |0) with \ipo) and I'lpi). One easily finds (see [20]) that Alice's optimal choice 
is 10) = A^d-^o) + |'0i)) where a normalization constant, yielding the optimal values: 

P*o =P.i = - + = - + . (7) 

Third, if Bob is dishonest, he will measure the state sent by Alice at step 2 so as to 
try to find out whether it is ipo or ipi, and he will then choose the value of b according to 
the result of his measurement. For the optimal measurement the probability that Bob 
wins is 



1 v^l- KV'il^o)!' 1 sin^ 
Po.=Pu = ^ + ^ = 2+^- 

The maximal value of the merit function hA^ax = — ^ ~ 0.021 occurs when 
cos(6') = sin(6') = l/\/2, corresponding to = 0.17. Note that this is the maximum 
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value for protocols which in the terminology of Spekkens and Rudolph [10] fall in the 
category "po and pi both pure" . 

3.3. Analysis in the presence of imperfections 

To obtain estimates on p^c? Pc* and p±±, and hence to estimate Ai, in the presence of 
imperfections requires that we make assumptions on how the experiment is carried out. 

The parameter, p±±, which we also call the Quantum Bit Error Rate (QBER), can 
easily be measured experimentally by tossing a large number of coins with Alice and 
Bob both following their honest strategy. 

3.3.1. Boh is dishonest When Bob is dishonest his cheating strategy is, as before, to 
estimate before step 2 the state \ipa) prepared by Alice so as to correctly guess the 
value of a. How do experimental imperfections, and in particular the limited visibility 
V of interferences affect Bob's success probability Pc*? To analyse this note that the 
state Alice sends to Bob is a short laser pulse of known intensity which is then strongly 
attenuated. Under strong attenuation all quantum states tend towards mixtures of 
coherent states (see e.g. [H]). Thus we can assume that the states prepared by Alice 
are coherent states of known intensity a^. These coherent states are not precisely known 
to Alice. However it is not difficult to show that if two coherent states have intensity a^, 
their scalar product is lower bounded by |('?/'i|'?/;o)| > e~^°^. Bob's cheating probability 
can then be bounded, as in equation (jH]), by the scalar product of the two states prepared 
by Alice: 



3.3.2. Alice is dishonest When Alice is dishonest we suppose that she can prepare an 
arbitrary state just in front of Bob's laboratory, and then send it to Bob. How do the 
imperfections in Bob's laboratory affect p,,c? To quantify this Bob could carry out a 
complete tomography of his measurement apparatus, and based on the results compute 
what is Alice's best cheating strategy. Here we will make a simple estimate based on 
easily accessible parameters. 

First of all let us consider the effects of the attenuation A^ during transmission 
between Alice and Bob's laboratories, of the attenuation in Bob's apparatus, and of 
the efficiency rj of his detector. We take these parameters into account by analysing a 
fictitious system in which Bob's apparatus is replaced by a lossless apparatus, and all the 
attenuation is under Alice's control, i.e. rj^^^* = 100%, A;^'^* = 1, and A^'^^ = AtAbT]. 
This replacement can only help a cheating Alice. In the fictitious system the state sent 
by an honest Alice is | ± a;^'^*) = | ± a^J AtAb^)- 

Second we analyse the effect of finite visibility on the performance of the fictitious 
system just described. Because of the finite visibility. Bob will not be making a 
projection onto the state | ± a^'^^), but onto slightly different states. We make the 
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Figure 1. Experimental setup: L, picosecond laser; Dl, main photon counter; 
D2, auxiliary photon counter; CI, 50/50 coupler; A, attenuator; Bob's phase 
modulator; PCM, polarization controller; PBS, polarizing beam splitter; C2, 80/20 
coupler; PD, photodiode; Alice's phase modulator; FM, Faraday mirror. 



assumption that Bob's apparatus acts as a passive linear optical system. This implies 
that the true states onto which Bob projects are slightly modified coherent states 
I ± 

^/ict _|_ ^^^^ The deviations due to 6± give rise to the optical contribution to the 
QBER: 

QBERopt = + \S^f) /2 = q\a{^y , (10) 

where q, the QBER per photon, can be related to the visibility V of interferences by 
g ^ (1 — V)/2. (Note that in addition to QBERopt, there is another contribution to the 
QBER due to the dark counts of the detectors. The total QBER is the sum of these 
two contributions: QBER = QBERopt + QBER^k-) 

The distance between the two states onto which Bob projects is given by 

i(+ar+5+)-(-«r+5_)r 

>4|4*^f -4|4'^*||(5+-5_| = 4|4*^f (1 - 2^^) . 

(11) 

Inserting this into equation (I7j) gives 

P*c<^ + ^ exp [-AbAtT] (1 - 2^) a^] . (12) 

Thus the effect of the imperfections is to replace by and effective attenuated intensity 
AbAtV (l - 2yg) a\ 

3.4- Experimental results 

Our experimental setup, depicted in Fig. 1, based on the plug and play system developed 
for long distance quantum key distribution [22], is very similar to the one described in 
|18] . It consists of an all-fiber (standard SMF-28) passively balanced interferometer, 
and is therefore well suited to long distance quantum communication. The protocol 
begins with Bob producing a short (300 ps) intense laser pulse at A = 1.55/im (idSOO 
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from idQuantique). The pulse is split in two by the coupler CI with equal reflection 
and transmission coefficients 50%. The two pulses are delayed one with respect to the 
other by 134ns. The pulses are then recombined on a polarizing beam splitter (PBS) 
and sent to Alice. The pulse that propagated along the long arm of the interferometer 
is strongly attenuated and will play the role of signal. The pulse that propagated along 
the short arm will play the role of local oscillator (LO). Upon receiving the pulses, Alice 
splits off part of them using the coupler C2 and sends this to a photodiode that triggers 
her electronics. At Alice's site the pulses are further attenuated by the different optical 
elements. They are reflected by the Faraday mirror. And Alice randomly chooses which 
phase $A = 0, TT to put on the signal pulse using her phase modulator. The signal 
Alice sends back to Bob is thus the coherent state | ± a) with average photon number 
lap = 0.27. 

When the pulses come back to Bob's site, they are sent along the short and long 
arm of the interferometer by the PBS and interfere at coupler CI. In front of the PBS is 
a delay line belonging to Bob which ensures that after the pulses enters Bob's laboratory 
he bluehas the time to send to Alice the value of the bit b and then receive from her the 
value of a. In our experiment the fiber pigtails of the PBS are sufficient to realize the 
delay. Upon receiving the value of a, Bob puts the corresponding phase $b = ott on the 
LO. This ensures that there should be destructive interference at the output port that 
goes to the circulator and then to detector Dl (id200 from idQuantique). If detector 
Dl registers a click. Bob aborts. If it does not click, the outcome of the coin toss is 
c = a(B b. The other output of coupler CI is monitored by detector D2, although this 
is not directly used in the experiment. 

There are in fact two security loopholes in this experiment. The first arises because 
Alice does not know the intensity of the signal pulse she attenuates before sending it 
back to Bob. Thus in principle Bob could send her a more intense state than expected, 
which would mean that the scalar product of the states prepared by Alice would be 
smaller than expected. The second security loophole arises because Bob does not know 
the intensity of the pulse he uses as LO. Thus in principle Alice could send Bob the 
vacuum state, both in the signal and LO, and cheat perfectly. Both loopholes could be 
closed by having Alice (Bob) monitor the intensity of the signal (LO) before she (he) 
attenuates it. This was not realised in the present setup because the laser pulses used 
were not intense enough, but would be possible using more intense or longer laser pulses 
as in [18], or by using an isolator combined with an amplitude modulator as in [21] . 

3.4-1 ■ Both parties are honest As mentioned above, we performed the experiment 
with |ap = 0.27. In a typical series 10000 coins were tossed, and we obtained 5066 
occurrences of c = 1, 2 occurrences of c =_L, the other outcomes being c = (which 
is consistent with the statistical uncertainty which should be of order ySOOO = 70). 
However we insist that the protocol can be used to toss a single coin. 

We estimate the merit function as follows. The abort probability is estimated by 
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tossing a large number (1.5 10^) of coins with Alice and Bob both honest: 

px± ^ 1-40 ±0.37 10"^ . (13) 

where the error comes from statistical uncertainty. 

The transmission losses are assumed to be negligible, Aj- = 1, as both parties are 
separated by a few meters of optical fiber. Bob's detector Dl has a. rj = 10% quantum 
efficiency. It is gated using a 2.5 ns gate leading to a dark count probability of 4.7 10~^. 
The attenuation of the signal in the optical elements of Bob's laboratory has been 
measured to he Ab — —6 dB (which includes the 3 dB losses at coupler CI where the 
signal and the LO interfere). Visibilities, as measured using an intense signal, were at 
least 99.0% (corresponding to g = 5 10"^). By inserting these parameters in equations 
([9]) and f|T2l) we obtain upper bounds for p^.^ and Pc*: 

p^c < 0.9971 and p^* < 0.906 (14) 

leading to the lower bound for the merit function: 

M > 1.33 10"^ . (15) 

This bound may seem very small. Its value is roughly explained by noting that 
the maximal value in the absence of imperfections is Aimax = 0.021. The main source 
of imperfections are the efficiency of the detectors (10 dB) and the losses in Bob's 
apparatus (6 dB). Thus we should reduce the attainable value of by a factor 40, 
yielding approximately equation (fT5|) . This argument shows that the simplest way to 
improve the experiment would be to use a more efficient detector. It also shows that 
the value of Ai is rather robust against small variations of the experimental parameters. 
We have computed that we could keep A4 positive while increasing losses between Alice 
and Bob to A^ — 4:A dB (more than 20 km of SMF-28 fiber), all other parameters being 
kept constant. 

3.4-2. Bob is dishonest In order to cheat Bob must estimate the state \tpa) prepared 
by Alice so as to correctly guess the value of a before sending the value of b. We 
implemented a simple cheating strategy in which Bob always applies $s = on the LO. 
If detector Dl clicks Bob assumes that Alice chose a = 1, whereas if Dl does not click 
he assumes a = 0. Implementing this strategy yielded the value pu = 0.505. This very 
low value is due to the small values of r] and Ab- Note that a much better cheating 
strategy, but which was impossible to implement in our laboratory, would be for Bob 
to carry out a homodyne measurement and measure the quadrature that gives him the 
best estimate of a. 

3-4-3- Alice is dishonest As discussed above, when Alice is dishonest her best strategy 
is to send a fixed state 10) = A^(| + a) + \ — a)) to Bob. After receiving b she then sends 
the value of a that makes her win the coin toss and hopes that Bob will not abort. In 
practice we implemented a strategy where Alice always sends | + a). Even though this 
strategy is very basic, it leads to p^c = 0.9956, which is very close to the theoretical 
maximum equation iHM . 
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4. Conclusion 

In conclusion we have studied in detail how the performance of quantum coin tossing 
protocols in the presence of imperfections should be compared to classical protocols. 
We then reported on a fiber optics experimental realisation of a quantum coin tossing 
protocol. Our analysis shows that in this realisation the maximum success cheating 
probabilities for Alice and Bob are respectively 0.9971 and 0.906 when experimental 
imperfections are taken into account, which is still better than achievable by any classical 
protocol. We implemented this protocol using an all-optical fiber scheme and tossed a 
coin whose randomness is higher than achievable by any classical protocol. Finally we 
implemented simple realisable cheating strategies for both Alice and Bob. 

After the present work was completed, we learned of a recent proposal specially 
designed for carrying out quantum coin tossing in the presence of losses [23]. Obviously 
taking into account losses, in particular those that occur in Bob's apparatus, was an 
important consideration when choosing and analysing the protocol reported here. The 
protocol reported in [23] seems more tolerant to loss then ours. Once the effect of other 
imperfections (such as finite visibility of interference fringes) are taken into account, it 
could be compared to ours using the merit function Ai introduced above. 
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Appendix 

Here we provide bounds on the performance of classical coin tossing protocols when 
there is some probability that the protocol aborts when both parties are honest. We 
also show that there exist classical protocols that attain these bounds. We use the 
notation and terminology introduced in the main text. The idea of the following result 
is to analyse the performance of a classical protocol with 3 outcomes [i.e. a classical 
protocol in which the parties try to toss a trit.). 

Lemma 1: For any correct classical coin tossing protocol with three outcomes 0, 1, _L 
we have: 




(A.l) 
(A.2) 




Proof of Lemma 1. We need to introduce some notation. 

The protocol consists of K rounds of communication, labeled j 

Denote by Uj the possible states of the protocol at round j. 



= 1,...,K. 



Experimental quantum tossing of a single coin 



11 



Denote by w{uj) the probability of reaching state Uj at round j in an honest 
execution of the protocol. 

Denote by w{uj+i\uj) the probability that in an honest execution, the protocol will 
be in state Uj+i at round j + 1 if it is in state Uj at round j. 

Denote by p*y{uj) the maximum probability that if Alice is dishonest and Bob is 
honest, then Alice can force Bob to output y at the end of the protocol if the state at 
round j is Uj. 

Denote by Px*{uj) the maximum probability that if Bob is dishonest and Alice is 
honest, then Bob can force Alice to output x at the end of the protocol if the state at 
round j is uj. 

Introduce the quantity Tj defined by 

Note that if we take x = and y = 1 the initial value (j = 1) of T is 
Ti(0, 1) = (1 — po*){l — p*i), ie. the left hand side of eq. (lA.ll) . 

Note also that at round K, when the protocol has ended, is equal to the sum over 
the final states of the protocol in an honest execution of the product of the probabilities 
that the output of Alice is not x and that the output of Bob is not y. Thus if we take 
X = and y = 1, then Tk{0, 1) = p±±, ie. the right hand side of eq. (lA.ll) . 

To complete the proof we show that T is an increasing function of j, ie. Tj+i > Tj. 
To this end suppose that at round j Bob will send some communication to Alice. 

Then Alice cannot influence what will happen at round j, hence we have: p*y{uj) = 

Eu,+, w{Uj+i\Uj)p^y{Uj+i). 

Furthermore we have the trivial identity w{uj+i) = J2uj 

Finally we note that since it is Bob's turn to talk at round j, we have 1 —Px*{uj) < 
1 — Px*X'^j+i) where Uj+i is any state at round j + 1 that can be obtained from state Uj 
at round j in an honest execution. 

Inserting these identities into the definition of Tj, we obtained the desired inequality 
Tj+i > Tj. 

The proof of eq. flA.2l) is similar. 

End of proof of Lemma 1 . 

We have also obtained a partial converse of Lemma 1: 
Lemma 2: There exists a correct classical protocol such that inequality M . 1\) is saturated, 



and there exists a correct classical protocol such that inequality I^A.Bi) is saturated. There 
also exists a correct classical protocol for which 

(1 -Po*)(l -P*i) = (1 -P*o) = • (A. 3) 



Proof of Lemma 2. Let us consider the following protocol: 

Round 1: Alice excludes one of the outcomes. That is she chooses that the outcome 
of the protocol will be either in {0, 1} (she has excluded _L), {0, _L} (she has excluded 1) 
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or {1, ±} (she has excluded 0). She tells her choice to Bob. If she is honest she chooses 
randomly among these three possibilities with a priori probabilities q^i, qo±, qi±. 

Round 2: Bob chooses which of the remaining two outcomes is the result of the 
protocol. He tells Alice what is his choice. Thus for instance if Alice told him that the 
outcome was in {0, 1}, Bob can choose that the outcome is either or 1, but not ±. If he 
is honest he chooses randomly among the two remaining possibilities with probabilities 

9o|oi! 9i|oi; (io\o±, ?±|o±; (ii\i±, <i±\i±- 

It is easy to check that, if the parties are honest, the probabilities are: 

Poo = '^'oioiQ'oi + (lo\o±(lo± 

Pii = ?i|oigoi + qi\i±qi± 

p±± = q±\o±qo± + q±\i±qi± ; (A.4) 

and that, if they are dishonest, the probabilities are: 

p^o = max{go|oi,go|o±} 
p^i = max{gi|oi,gi|i_L} 

Po* = qoi + qo± 

Pi* = qoi + qi± ■ (A. 5) 

If we choose the parameters such that qo± = qi±, go|oi = qi\oi = 1/2; qo\o± = qi\i± > 
1/2, then the protocol is correct and eq. ( ]A.3|) is verified. 

And if we choose go± = then we have p±± = g_L|i_Lgi_L = (1 — qi\i±){l — qoi) and 
Po* = qoi, P*i = qi\i± thus saturating eq. (lA.ll) . Note that by adjusting the remaining 
free parameter go|oi one can make the protocol correct. 

Similarly one can saturate inequality ( 1A.2I) . 

End of proof of Lemma 2. 

References 

[1] Blum M 1981 Coin flipping by telephone: A protocol for solving impossible problems Advances 
in Cryptology: A Report on CRYPTO 81 ed A Gersho (Santa Barbara, ECE Report No 82-04) 
pp. 11-15 

[2] Bennett C H and Brassard G 1984 Quantum cryptography: Public key distribution and coin 
tossing Proc. of IEEE Int. Con}, on Computers, Systems and Signal Processing (Bangalore), 
pp. 175 - 179 

[3] Mayers D 1996 Unconditionally secure quantum bit commitment is impossible Preprint 

|arXiv:quant-ph/ 9605044 (1996) 
[4] Lo H-K and Chau H F 1998 Why c^uantum bit commitment and ideal quantum coin tossing are 

impossible Physica D 120, 177 
[5] Mayers D, Salvail L and Chiba-Kohno Y 1999 Unconditionally secure quantum coin tossing 

Preprint http://xxx.lanl.gov/abs / quant-ph/9904078 
[6] Kitaev A Y 2002 Lecture delivered at QIP 2003, MSRI, Berkeley, OA (unpubUshed); onhne at 

http: / / www.msri.org/ publications / video / index05 .html 
[7] Goldenberg L, Vaidman L and Wiesner S 1988 Quantum gambhng Phys. Rev. Lett. 88, 3356 
[8] Aharonov D, Ta-Shma A, Vazirani U V and Yao A C 2000 Quantum bit escrow 32nd Symp. on 

Theory of Computing (STOC 00) (ACM Press) pp. 705 - 724 



Experimental quantum tossing of a single coin 



13 



[9] Ambainis A 2001 A new protocol and lower bounds for quantum coin flipping Proc. on 33rd Annual 

ACM Symp. on Theory of Computing (New York) (ACM Press) pp. 134142 
[10] Spckkens R W and Rudolph T 2002 Degrees of concealment and bindingness in quantum bit 

commitment protocols Phys. Rev. A 65, 012310 
[11] Mochon C 2007 Quantum weak coin flipping with arbitrarily small bias Preprint 

http://lanl.arxiv.org/abs/0711.4114' 
[12] Amabainis A, Buhrman H, Dodis Y and Rorig H 2004 Multiparty quantum coin flipping Proc. of 

the 19th Annual IEEE Conference on Computational Complexity pp. 250259 
[13] Gutoski G and Watrous J 2007 Toward a general theory of quantum games Proc. of the 39th ACM 

Symp. on Theory of Computing, pp. 565574 Preprint arXiv:quant-ph/0611234v2 
[14] Buhrman H, Christandl M, Hayden P, Lo H-K and Wehner S 2006 Security of quantum bit string 

commitment depends on the information measure Phys. Rev. Lett. 97 250501 
[15] Jain R 2008 Stronger impossibility results for quantum string commitment Journal of Cryptology 

(JoC) to appear Preprint arXiv:quant-ph/0506001 
[16] Damgard 1 B, Fehr S, Salvail L and Schaffner C 2008 Cryptography in the Bounded-Quantum- 
Storage Model SIAM Journal on Computing 37 1865 
[17] Molina- Terriza G, Vaziri A, Ursin R and Zeilinger A 2005 Experimental Quantum Coin Tossing 

Phys. Rev. Lett. 94 040501 
[18] Lamoureux L-Ph, Amans D, Brainis E, Barrett J and Massar S 2005 Provably Secure Experimental 

Quantum Bit-String Generation Phys. Rev. Lett. 94 050503 
[19] Buhrman H, et al. 2007 High Entropy Random Selection Protocols Proc. of the 11th Int. 

Workshop on Randomization and Computation (RANDOM07); Approximation, Randomization, 

and Combinatorial Optimization Algorithms and Techniques, Lecture Notes in Computer Science 

Volume 4627/2007, (BcrHn: Springer) 
[20] Barrett J and Massar S 2004 Quantum Coin Tossin Phys. Rev. A 69, 022322 (2004). 
[21] Wallentowitz S and Vogel W 1996 Unbalanced homodyning for quantum state measurements Phys. 

Rev. A 53 4528 

[22] Ribordy G, Gautier J D, Gisin N, Guinnard O and Zbinden H 1998 Automated "plug & play" 

Quantum Key Distribution Electron. Lett. 34 2116 
[23] Berlin G, Brassard G, Bussieres F, Godbout N 2008 Loss- Tolerant Quantum Coin Flipping 2nd 

Int. Conf. on Quantum, Nano, and Micro Technologies (ICQNM08) (fehruary 2008, Sainte Luce 

- Martinique), pp. 1 9 

[24] Legre M, Zbinden H and Gisin N 2006 Implementation of continuous variable quantum 
cryptography in optical fibres using a go&return configuration Quantum Info. Comp. 6 326 



